healer | c82fe254e8cfb54a0b412db6a1150ac6952e3f9beb73fde881529bd737581d3a | Triage

Sharing

General

Target

c82fe254e8cfb54a0b412db6a1150ac6952e3f9beb73fde881529bd737581d3a
Size

1.0MB
Sample

231012-dhvsqsdh65
MD5

d458ad458abc415304fd2c142d7f4745
SHA1

6acfc584e7f647685db6a1d167c1a68b5d7d1a0b
SHA256

c82fe254e8cfb54a0b412db6a1150ac6952e3f9beb73fde881529bd737581d3a
SHA512

3e91ac67520164034976dbc4c516d0a10eed6f70f8aa4f5766b97c5a4dbb3f4136f1b3454dcb78fc3e72d06bae601d8facd35d25ad2b39545482c93438fa573f
SSDEEP

24576:byB7LsVeg07T5RZzVgOoLuzdj6nEmSJBoCWI:OB3Wd0vXrAO2nEmWBoC

Score

10^/10

healer dropper evasion persistence trojan

Malware Config

Targets

- Target
  
  c82fe254e8cfb54a0b412db6a1150ac6952e3f9beb73fde881529bd737581d3a
- Size
  
  1.0MB
- MD5
  
  d458ad458abc415304fd2c142d7f4745
- SHA1
  
  6acfc584e7f647685db6a1d167c1a68b5d7d1a0b
- SHA256
  
  c82fe254e8cfb54a0b412db6a1150ac6952e3f9beb73fde881529bd737581d3a
- SHA512
  
  3e91ac67520164034976dbc4c516d0a10eed6f70f8aa4f5766b97c5a4dbb3f4136f1b3454dcb78fc3e72d06bae601d8facd35d25ad2b39545482c93438fa573f
- SSDEEP
  
  24576:byB7LsVeg07T5RZzVgOoLuzdj6nEmSJBoCWI:OB3Wd0vXrAO2nEmWBoC
Score

10^/10

healer dropper evasion persistence trojan
- Detects Healer an antivirus disabler dropper
- Healer
  Healer an antivirus disabler dropper.
  dropper healer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

healerdropperevasionpersistencetrojan

behavioral2

healerdropperevasionpersistencetrojan